Re: Elevating trust on a locally deployed .NET application

This won't have anything to do with CAS or CASPOL as it is local Windows
permissions that are the issue here. CAS can only further reduce the
permissions that the OS itself grants. It cannot elevate above what the OS
grants.

So, what you need to do is to find a way to get this deployment done using
an admin account. There are generally ways to do this sort of thing with
MSI and group policy and such, but it looks as if the original deployment
mechanism was implemented such that you can't take advantage of that.
Ideally, the initial deployment that runs with the elevated permissions
would perform all of the actions that require high permissions such as ngen
(which is what is likely writing to native images) and whatever XML policy
changes are being implemented to change the local .NET CAS policies.

This might be something that could be worked into a startup script GPO or
something, but that isn't really my specialty at all. Perhaps asking the
question in one of the group policy newsgroups would be good? Sorry I don't
have a better answer.

Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"dmcaylor" <dave.caylor@xxxxxxxxx> wrote in message
news:b9123b8b-4168-493d-9845-3681d991c8fe@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Let me preface this by saying I do not know .NET from .NUT.

We have a .NET 1.1 vendor application that need to be deployed to
several thousand XP workstations.
Users have restricted accounts on these workstations. (i.e. not power
users or admins)

The initial application MSI is installed remotely by an admin account.
It installs a "bootstrap" file that the users run directly. When run,
the bootstrap connects to a Unix webserver and pulls down the current
executable for the application.

My problem is with rights. Neither the bootstrap.exe or the client.exe
will install or run correctly unless the user is an administrator.
Both the bootstrap and client try to create files under C:\WINDOWS
\assembly\NativeImages1_v1.1.4322\System, System.Design,
System.Draving, System.Windows.Forms, & System.Xml. They both also
attempt to modify C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG
\security.config.cch, and enterprise.config.cch.

When running under a restricted user account, all of those attempted
creates/writes fail. The programmer who wrote the application is no
longer with the vendor, and their solution is to make everyone an
admin (not going to happen). This is a core application, and I do not
have the option of shucking it out the door.

So, I need to know how to elevate the trust for these executables on
several thousand workstations. Neither executable has been given a
strong name by the vendor, so I don't think CASPOL will work? Also,
although the bootstrap is installed by an admin account at the time of
deployment, the client.exe does not get downloaded to the local PC
until the user runs the bootstrap. So there is no file available to
elevate trust on.

The .Net 1.1 config tools mention creating an MSI to deploy security
changes, but it appears to make a copy of all my security settings,
not just those related to this app.

Thanks. Any assistance would be appreciated.


.

Relevant Pages

  • Re: Elevating trust on a locally deployed .NET application
    ... permissions that the OS itself grants. ...  It cannot elevate above what the OS ... what you need to do is to find a way to get this deployment done using ... It installs a "bootstrap" file that the users run directly. ...
    (microsoft.public.dotnet.security)
  • Re: I really screwed up group policy this time...!
    ... admin account and revise the policy to be less restrictive. ... >>>> accessing Folder Options through Windows Explorer's Tools menu. ... >>>> In the Permissions box, change the Read setting, and only the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Exchange Mailboxes - Open other users folder
    ... A recent hotfix changed the way permissions are applied to exchange. ... with a system admin account created for this purpose. ... Either through the File, Open other users folder, or by creating profile ... When creating profile and logging on with the admin account, ...
    (microsoft.public.exchange2000.admin)
  • Re: Problem with security settings for internet explorer
    ... >> Sherlock Holmes ... > was pretty good with 98se but never ntfs or permissions and am trying ... > Admin account and I can right-click on the desktop icon and go to ... I think that is the only strange behavior that ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Digital signing of assembly hosted in IE
    ... There is also the option of creating a security deployment msi package that ... Check out the Create Deployment Package option under Runtime Security ... > to make it easier for deployment of code requiring greater permissions ...
    (microsoft.public.dotnet.security)